4,624 skills sorted by stars.
Retrieve bounded receipt evidence by exact ids or explicit filters, returning native verification results for downstream...
Security reconnaissance. USE WHEN recon, reconnaissance, bug bounty, attack surface. SkillSearch('recon') for docs.
One line: port/host/service discovery tool arsenal for authorized engagements. Pack in trigger signals so it auto-loads:...
Deep DNS analysis for attack surface — record mining, zone transfers, DNSSEC/NSEC walking, and dangling records. Load du...
Find secrets and internal detail an organisation leaked to public code — GitHub/GitLab repos, gists, and commit history....
Full-stack recon-to-bug pipeline. Runs passive enumeration, attack surface mapping and bug discovery in one continuous f...
Bug bounty and pentest reconnaissance methodology
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detect...
Guide authorized external penetration testing from recon through validation and scoped exploitation using free and open-...
Detect stack overflow and infinite recursion DoS in recursive parsers, tree walkers, and serializers that lack depth lim...
Adversarial review workflow for pressure-testing an existing candidate plan, diagnosis, design, argument, proposal, or r...
Authorized red team engagement planning, C2 architecture design, attack methodology, lateral movement strategy, OPSEC, a...
This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate r...
Draft, rewrite, or audit modular enterprise technical documentation using an independently expressed interpretation of t...
Use when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations....
This skill should be used when the user asks to "plan a red team engagement", "scope a penetration test", "design a secu...
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
Adversarially probe this monorepo for security flaws at the right depth. Steers the red-team subagent — picks quick/stan...
Generate SITF-compliant attack flow JSON from red team or pentest reports. Accepts report files, URLs, or pasted finding...
A friendly, mischievous critical-thinking partner that pokes holes in plans, proposals, grant aims, study designs, slide...
Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerabil...
The Verification Agent — challenges Build Agent artifacts via independent verification. Executes tests against artifacts...
Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoint -...
Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access contr...
刑部红线清单 R01-R10（刑部常驻加载），安全合规审查的不可违反规则
Use when the user wants to test their LLM/agent application for safety and security vulnerabilities — jailbreaks, prompt...
Red team adversarial analysis to find weaknesses, vulnerabilities, and failure modes. Use before launches, for security...
Adversarial analysis with 32 agents. USE WHEN red team, attack idea, counterarguments, critique, stress test. SkillSearc...
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from a...
Adversarial security review fleet for the Port Daddy whitepapers (Bonded Commons, Anchor Protocol). Use when a paper ver...
On-demand senior red-team lead advisor. Call at a decision point or obstacle to get wiki-grounded direction instead of h...
Use to assess regulatory applicability for products that may fall under AI regulation (EU AI Act, Article 50 transparenc...
Use when an application or system — including one built quickly with AI coding agents — needs a security review with reg...
Comprehensive release readiness audit covering security, dependencies, community files, and code quality. Use when asked...
Post-commit gate. Invoke after every commit (right after /flagrare:staleness-audit). Checks whether a release is due, an...
Use this skill whenever determining whether a build is ready for production deployment — including pre-release reviews,...
Release gating rules and evaluation for BLOCKED, READY_FOR_REVIEW, and PASS release decisions.
Changelog and release notes.
Explicit-invocation, evidence-backed, read-only release gate for a specific candidate version, returning GO, GO WITH CON...
Get a context-aware remediation plan for a vulnerability with fix verification steps
Audit, write, or revise renovate.json. Use when adding Renovate, troubleshooting unexpected (or missing) update PRs, har...
Use when independently verifying a supplied PoC against fresh live before/after deployments.
Apply Replit security best practices for secrets and access control. Use when securing API keys, implementing least priv...
Auditoria multifase multiagente de un repo (dead code, legacy, seguridad, proceso) con bucle adversarial de verificacion...
Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan...